[blind029]

I went through the cleanup, cwshredder, ewido, virus scan, trend micro housecall, well all those initial steps, but i didn't do a windows update cause it can only make it worse right?
So the problem i'm having is with aurora, and i actually got the popups to go away...for like an hour and they came back, but i know the infection is still there because i can't delete the nail file.
Also we've been having problems with the computer for a long time so it wouldn't suprise me to be having other problems.
I'd imagine you need more but i'll start with my hijack this log file.

Logfile of HijackThis v1.99.1
Scan saved at 12:26:21 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
c:\windows\system32\ynkivje.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ian McIlraith\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nsx23B.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [qsttarj] c:\windows\system32\ynkivje.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AntiVirusScanv.1.] C:\WINDOWS\AntiVirusScanv.1.3.pif
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk.disabled
O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099431678201
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Welcome blind029 to Geeks to Go!

Please open Start> Run and type MSConfig in the 'Run' box. When the System Configuration Utility opens, go to the 'Startup Tab' and make sure there is a checkmark beside each entry. Then the general tab should have the "normal startup" option checked. REBOOT when asked to by Windows to complete the change

After completing the above please have them Scan again with HJT and POST a new HJT log in here in this topic using 'Add Reply' to see what there is to clean.

[g2i2r4]

Welcome blind029 to Geeks to Go!

Please open Start> Run and type MSConfig in the 'Run' box. When the System Configuration Utility opens, go to the 'Startup Tab' and make sure there is a checkmark beside each entry. Then the general tab should have the "normal startup" option checked. REBOOT when asked to by Windows to complete the change

After completing the above please have them Scan again with HJT and POST a new HJT log in here in this topic using 'Add Reply' to see what there is to clean.

[blind029]

Ok, i went to msconfig, it was set for selective startup, and there were a few things unchecked on the startup tab. So here's the new log

Logfile of HijackThis v1.99.1
Scan saved at 12:05:36 AM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
c:\windows\system32\czbhclu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ian McIlraith\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nsx23B.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [ctcsbhd] c:\windows\system32\czbhclu.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AntiVirusScanv.1.] C:\WINDOWS\AntiVirusScanv.1.3.pif
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099431678201
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[g2i2r4]

You are running HijackThis from the Desktop; please create a new folder for it and move the program into the new folder

***

Please disable SpybotSD’s protection, as it may hinder the removal of the infection. You can enable it after you're clean.

Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on System Startup icon.
Uncheck Uncheck Resident.
Click Allow Change box.

***

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

***

Download the Killbox.
Unzip it to the desktop but do NOT run it yet.

***

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

***

Download Process Explorer from http://www.sysintern...ssExplorer.html

Run Process Explorer and find the Process in the list of Processes.
Select the process and click Process > Suspend.

Then in HijackThis click Config > Misc Tools > Delete a file on reboot...
In the explorer Window select the file
c:\windows\system32\czbhclu.exe
When prompted if you want to reboot click YES
Leave Process explorer running with the process suspended.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

***

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

***

Next please run HijackThis, click Scan, and check:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)

O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nsx23B.dll (file missing)

O4 - HKLM\..\Run: [ctcsbhd] c:\windows\system32\czbhclu.exe r

O4 - HKCU\..\Run: [AntiVirusScanv.1.] C:\WINDOWS\AntiVirusScanv.1.3.pif

Close all open windows except for HijackThis and click Fix Checked.

***

Please double-click Killbox.exe to run it.

Select "Delete on Reboot".
Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:

c:\windows\system32\czbhclu.exe

Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button.
Click "No" at the Delete on Reboot prompt.

Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:

C:\WINDOWS\AntiVirusScanv.1.3.pif

Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button.
Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
Make sure to reboot back to save mode.

***

Run a scan using Ewido, save the log.

***

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

[blind029]

Wow that's a lot of stuff, thanks for the help by the way. Well i haven't done anything yet cause i'm a little mixed up on a couple things.

You said go to Spybot and disable the resident, well i didn't find it in system tools, there was one for resident, and i unchecked both of them that were on in there.

Also i went to set hijack to delete czbhclu.exe, but it's not there. I did se ctfmon, and i thought maybe that's the one?

So that's as far as i got, I know it's gotta be tough so i really appreciate it.
Ian

[g2i2r4]

Run Process Explorer and find the Process in the list of Processes.
Select the process and click Process > Suspend.
c:\windows\system32\czbhclu.exe


Then in HijackThis click Config > Misc Tools > Delete a file on reboot...
In the explorer Window select the file
c:\windows\system32\czbhclu.exe
When prompted if you want to reboot click YES
Leave Process explorer running with the process suspended.



This one is a name changer. So I'll explain where you can find it. In the HijackThis log it's the one in red. The other ones are legit and need to stay.

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [ctcsbhd] c:\windows\system32\czbhclu.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

It has a random name.
It has a space and the letter r behind it.

Please find it's new name and use that one.

[blind029]

Well i've done the steps up to the ewido scan, which i'm doing as we speak, and then another hijack this log. The problem i'm having is the ewido crashed, so i have to do it again, and now the computer won't connect to the internet.

I'm suspicious it's the modem cause it's having some trouble and any computer i hook it up to. But is there something i could try that could have been caused by the steps i did?

[g2i2r4]

We haven't removed anything that could cause this.

You say any computer hooked to the modem is having problems. Guess it must be something with the modem then.

What modem are you using?

[blind029]

Well i'm suspicious of the modem, and i'll tell you why. first off it's a toshiba pcx2500

But i've found that if i unplug it, and plug it back in at the windows logon screen and then logon, it works. If i don't do that, the lights all come on and show that it's working, but no internet connection. Then i took it into my room and hooked it up on my computer. Now this computer has no constant connection and should be free and clear of any malware or viruses. So i hooked it up there, and the same problems, but it's a little easier to get it to work.

Back to the ewido scan, it seems to go into an illegal operation at about 86 percent every time while i'm in safe mode. Seems a bit weird to me. Will it be anywhere near as affective without going to safe mode?

[g2i2r4]

Please keep this link for use later:
http://www.toshiba.c...bleshooter.html
It's a troubleshooter page from Toshiba with a download link to the driver for your modem.

Let's first clean this computer.

Please post me the HijackThis log you have now and if possible the scan log made my Ewido.

Let's see where we stand now.


Also do this please:
Open HijackThis
Go to ‘config’
Go to ‘misc tools’
Press the button ‘open uninstall manager’
Press the button 'save list'. It will open a Notepad file. Place the content of that file here in your answer please.

[blind029]

Alrighty, well i'll try the ewido again tonight and hopefully it'll go through this time, but here's the hijack this from a normal startup. I'll also note that before i changed the startup options there were two unselected. Both were supposed to be microsoft updates, but for a file name it was like 4 boxes and then some letters and numbers. So I unchecked them again, and when i startup those pop up as file failed to load, but the internet seems to be working now.

Logfile of HijackThis v1.99.1
Scan saved at 5:55:29 PM, on 7/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Ian's Comp\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.mercurycougar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
F3 - REG:win.ini: load=????
F3 - REG:win.ini: run=????
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AntiVirusScanv.1.] C:\WINDOWS\AntiVirusScanv.1.3.pif
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099431678201
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[g2i2r4]

Let's clean your Prefetch folder:
Locate C:\Windows\Prefetch folder and open it. Delete the contents of the folder (NOT THE FOLDER) if there are many choose Edit then Select all then Delete. You may not be able to remove them all, don't be concerned unless any have the name of the items we need to remove.

***

Choose File > Run, type "win.ini" in the Command Line text box, and click OK to open the file in Windows Notepad.
Save it to your desktop as geeks.txt
exit Notepad. Post the content of the geeks.txt file.

***

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

F3 - REG:win.ini: load=????

F3 - REG:win.ini: run=????

O4 - HKCU\..\Run: [AntiVirusScanv.1.] C:\WINDOWS\AntiVirusScanv.1.3.pif

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

Please post me a log make by Ewido.

[blind029]

I still can't get the ewido to complete a scan, it goes into an error at about 85 percent and windows shuts it down. So i have to go to work but i'll re-install and try again. Sorry it's taking so long but my parents are incompetant when it comes to computers and it feels like i work everyday. But so far all the popups are gone, the computer seems to run better to me, although i'm still fighting the modem and i can't get my dad to get cox out here to work with it. Thanks for all the help so far.

[g2i2r4]

First do this:

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

***

Then rerun Ewido. Don't forget to save the log, I would like to see what it says.

[blind029]

I didn't see your post yet so i re-installed ewido and got it to run all the way through, here's the results.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 6:59:49 PM, 7/7/2005
+ Report-Checksum: DACC0B13

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1715567821-1202660629-1708537768-1006\Software\intexp -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1715567821-1202660629-1708537768-1006\Software\intexp\Config -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1715567821-1202660629-1708537768-1006\Software\intexp\MyFileSystem2 -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1715567821-1202660629-1708537768-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
C:\WINDOWS\jrdtjqi.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Amber McIlraith\Cookies\amber mcilraith@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Amber McIlraith\Cookies\amber [email protected][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Heime McIlraith\Cookies\heime [email protected][2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Heime McIlraith\Cookies\heime [email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Heime McIlraith\Cookies\heime mcilraith@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Heime McIlraith\Cookies\heime mcilraith@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Heime McIlraith\Cookies\heime mcilraith@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Heime McIlraith\Application Data\Mozilla\Firefox\Profiles\9u76d60x.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane mcilraith@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane [email protected][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane mcilraith@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane mcilraith@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane mcilraith@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Liane McIlraith\Cookies\liane mcilraith@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Liane McIlraith\Application Data\Mozilla\Firefox\Profiles\qtunw1yx.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian mcilraith@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian mcilraith@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian [email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian mcilraith@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian [email protected][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian mcilraith@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Ian McIlraith\Cookies\ian mcilraith@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.120:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.162:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.179:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.180:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.181:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.182:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.185:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.187:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.188:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.189:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.192:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.196:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.251:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.282:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.290:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.291:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.322:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.323:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.324:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.325:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.326:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Sexlist : Cleaned with backup
:mozilla.339:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.340:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.341:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.342:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.345:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.346:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.347:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.348:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.349:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.356:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.357:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.359:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.383:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
:mozilla.403:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.404:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.446:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.451:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.463:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.464:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.465:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.492:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.547:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.549:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.553:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.561:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.562:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.635:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.636:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.637:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.659:C:\Documents and Settings\Ian McIlraith\Application Data\Mozilla\Firefox\Profiles\1brf4113.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup
D:\WINDOWSold\system44.exe -> Heuristic.Win32.Morphine-Crypted : Cleaned with backup
D:\WINDOWSold\TEMP\Altnet\pmfiles.cab/sysdetect.dll -> Adware.BrilliantDigital : Error during cleaning
D:\Stuff from C_6_12_03\Recovered Files\WD\Program Files\webHancer\Programs\WBHSHARE.DLL -> Spyware.WebHancer : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@adorigin[1].txt -> Spyware.Cookie.Adorigin : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@adviva[1].txt -> Spyware.Cookie.Adviva : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@bluemountain[1].txt -> Spyware.Cookie.Bluemountain : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@centrport[3].txt -> Spyware.Cookie.Centrport : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][3].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@euniverseads[1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[3].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[4].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[5].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@fastclick[7].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@flycast[2].txt -> Spyware.Cookie.Flycast : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@focalink[1].txt -> Spyware.Cookie.Focalink : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Preferences : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@hitbox[3].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@linksynergy[2].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@linksynergy[3].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@mediaplex[2].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@mediaplex[3].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@mediaplex[4].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@paycounter[1].txt -> Spyware.Cookie.Paycounter : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Offshoreclicks : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@popupsponsor[1].txt -> Spyware.Cookie.Popupsponsor : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@preferences[2].txt -> Spyware.Cookie.Preferences : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@questionmarket[3].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@questionmarket[4].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@ru4[3].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][3].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@sexlist[1].txt -> Spyware.Cookie.Sexlist : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@sextracker[1].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@spylog[1].txt -> Spyware.Cookie.Spylog : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@spylog[2].txt -> Spyware.Cookie.Spylog : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Porntrack : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@targetnet[2].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@valueclick[3].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Realtracker : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Gator : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Brilliantdigital : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Directnetadvertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Popuptraffic : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@x10[2].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@x10[3].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@x10[4].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\anyuser@xxxcounter[2].txt -> Spyware.Cookie.Xxxcounter : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\[email protected][1].txt -> Spyware.Cookie.Ads360 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Cookies\user@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@admonitor[1].txt -> Spyware.Cookie.Admonitor : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Link4ads : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@doubleclick[2].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@flycast[2].txt -> Spyware.Cookie.Flycast : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@focalink[1].txt -> Spyware.Cookie.Focalink : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@preferences[2].txt -> Spyware.Cookie.Preferences : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@spylog[2].txt -> Spyware.Cookie.Spylog : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Realtracker : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\anyuser@x10[1].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Link4ads : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@bfast[1].txt -> Spyware.Cookie.Bfast : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@mediaplex[3].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@x10[1].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Profiles\User\Cookies\user@x10[2].txt -> Spyware.Cookie.X10 : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Temporary Internet Files\Content.IE5\1JC1RN2F\anal3[1].exe -> Dialer.Generic : Cleaned with backup
D:\Stuff from C_6_12_03\Recovered Files\WD\WINDOWS\Temporary Internet Files\Content.IE5\1JC1RN2F\id2[1].htm -> Trojan.WindowBomb.a : Cleaned with backup


::Report End